auth improvements and fixes