change authorization on users api