fixing order of auth check