added missing lock to SetAuthorization