update auth rules