bugfixes in user authentication