fixed bug in auth()