fixed authentication permissions'