support self-defined authorization endpoint