auth endpoint fixes