fixed auth restriction not work