[auth] fixes