so user authorization can be checked