don't override authorization if set