fixed callback authentication