change auth logic