fix the auth xml: every page can reached now