more unauth'd check fixes