users are only authorized across one request