auth UPDATE instead REPLACE