authentication and authorization work