fixed authentication authorization