lot of auth-related bugfixes