Only authorize should be protected