removed TODOs from authorization