Fix a authorization flaw