added authorization to users actions