fixed bug in authenticate