add authorize handler