fix bug:authencation : every successful auth only valid for its request