authentication bug