move authorize action to instance methods