authorization

closes #2