authentication: bugfix