fixed authentication when user is not logged in