fixed bugs, fall back to internal auth