more tweaks to external auth