bunch of auth-related fixes