timestamp checking bug-fix, always take body content before auth