add security check to avoid bypass auth