uses configured upstream authorization call