actually make domain admin authorization work