authorization hook and tests