fix bug: authorization response may be captured by receiving thread