refactor the authorization routes
finalize authorization