Question on authorization - Better Auth