tighten up the authorization method