move authorizeLocals before authorize view