use surrogate authorization to support adding new charities