upgrade auth logic