Backport authentication security fixes