authorize after redirect