finally fixed auth