auth: now authorizes requests