fixed security bug where user could bypass authentication