added authorization strategy