Fix nasty promotion bug in auth code