more auth fixes