bug in authentication