updated authorized() to check for "ids" as well

sometimes you only have the id, not the identity