fix allow authenticated