fixed authentication/authorization bugs