refactor to authorize at startup