auth rewrite