fixed bug in auth