TAGs: signed authorization required