request and grant authorization