fix signout bug; add authorization