authorization added for many user functions