bug at defaultAuthCode