add openAPI authorization, failing at the moment
before merge