external auth bug fixes