fix bug in notification api auth