use /* url with authorize