single authorization now works