set up authentication and authorization