added authorize, deauthorize to model