refactor code for security
change to to list for authorities