authorization seems to work (needs heavy testing) [fixed #4]