updated authorization for viewing 'Patients' button