fix authorization bug