auth on update