fix authentication hole