swagger with authorization