Added: authenticate before access