bug fix on auth