updated auth logic