fixed some auth stuff on the backend