fix settings unauthorized access