Fixed auth rules