auth: add patch, remove