also, maybe we should standardize on using load_and_authorize?