webshell auth & path