stupid js precedence causing false positives in auth