update auth lib

Since tcUser is hardcoded in auth lib for now, I cannot set his permissions in test env. So the test may be simple as it doesn't cover all scenarios.
Yes, this code was created before we removed the safelist.  It needs to be integrated into the current code.