better auth checking and removing timeout (thanks @jerith)