allow authorized users to see cards+status