moved Authorization into its own project