cleaned up authorization/authentication