auth fixes