why do we need a separate `Authorization` for heroing?