minor fixes to auth