add readme for authorization