finishing authentication and authorization