fixed authorization scheme