authentication and authorization tuning