move authorization into the view pipeline