fixed minimal authorization