authorization fixes