fix forbidden parameters
auth
fixed bug on auth