getStory now requires authorization
sanitize function improved