cleaning up make-authorize-url a bit