un-hack auth endpoint