hard-coded check if user is super_admin in authorize