fix authentication bug that exposed list before logged in