[php] adds unauthorized button