fix bugs with auth