fixed mass assignment issue with authorization