Fix incorrect auth check (was always denied)