fix a auth bug