fix authorization URL