don't clobber authorization attributes