add lodash dependency
handle the notAuthorized case