properly set the resource IDs on the authorization request