fix auth bugs