make authorize return a promise