fix logic in auth backend and test login