Yeah not tmk. Auth tells the server I hold this private key, please check your whitelist sir. Otherwise I could just say I'm whatever npub I want, there is no way to prove I am who I am. IP whitelists only work because I can't lie about my IP if I want you to send data back to me. :|