fixed security bug where user could overcome authentication