add in role based authorization, directions, etc