fixed auth web api filter