Add step to operate on behalf of the user, via authorization