fix < 8 location auth, better logic, and alert when denied