call offAuth() with correct method.

closes #471.