add authorization levels for users