use promises for authorization