fix critical bug in authorization class