added authorization checking