added authentication/authorization