There was a variable name mish-mash

You declare auth, then use authorization. Does not hurt functionality, but causes undeclared global variable.