fix the authentication logic with module access taking account