changed Authorized() to protected for greater flexibility for callers