authorization working for the most part