Added server-side check for operation authorization.