fixed some bugs and add authentication to some actions