#20 restrictions for authorization