conceals mistakenly exposed auth ui