fix buglets in new authentication code (issue #4860)