authentication and authorization touch-ups