authorization closes #2