auth api fixes