fix a bug in ensureAuthenticated.