http service: create authorize response