various bugs on authorization