CMS should extend prior authorization pilots, GAO says