more fixes in auth