WIP: refactoring authorization-server