fixed authentication for PUT requests