removed state variable from authorization req