set attributes from auth hash correctly