updated user authorization (api)