add authorisation filter