fix #213: regenerate url after auth