    // if a receiver was specified, check that it was the pool manager who
    // is sending the message, as it has the possibility to lock LP tokens on
    // behalf of the user
    let receiver = if let Some(ref receiver) = receiver {
        let receiver = deps.api.addr_validate(receiver)?;
        ensure!(
            info.sender == config.pool_manager_addr || info.sender == receiver,
            ContractError::Unauthorized
        );

        receiver
    } else {
        info.sender.clone()
    };
// if a receiver was specified, ensure the sender is either:
// 1. the pool manager (who can create positions on behalf of any user) or
// 2. the receiver themselves (users can create their own positions)
let receiver = if let Some(ref receiver) = receiver {
    let receiver = deps.api.addr_validate(receiver)?;
    ensure!(
        info.sender == config.pool_manager_addr || info.sender == receiver,
        ContractError::Unauthorized
    );
