authorisation and some authentication