authorization refactoring