refactor authorize() to isAuthorized and applied to the core