fix passive auth bug