deny authorization request seems to be working pretty well