fix authorization endpoint