authorization partially working for apis