authorization user step 1 of 2