using authorization middleware as opposed to parcing it myself