fix unauthenticated state in right place