fixed auth redirect