two authentication bugs