refactored Authorize