FIX: broken external auth