fix bearer token auth