more authentication tweaks