preferences fixed if auth not in application controller