move authorization to OnAuthorization