fix auth order