Tweak scaffolds to make authorization actually work