done some refactoring, added new authorization tests