minor bug in auth