rewrite auth