so authentication works. Authorization, however... not so much