#2: auth fixed