add explanation about authorization