renamed parent_object variable to parent_obj in is_authorized