implemented authorization checking