fixed a bug in auth