auth callback bugfix