bug fix - access denied in form based auth