correcting authentication and authorization ...