better enforcement of returning auth identity