fix bug in auth token consume and consumed logic