use rate limit status for authorized?