tweak the authorization of user