(#6) - add authorization