diff --git a/lib/relay.js b/lib/relay.js
index 42df80c..156b392 100644
--- a/lib/relay.js
+++ b/lib/relay.js
@@ -240,9 +240,9 @@ var Server = {
 
     return result || srv.socketId;
   }
-, onAuth: function onAuth(state, srv, newAuth, grant) {
+, onAuth: function onAuth(state, srv, rawAuth, grant) {
     console.log('\n[relay.js] onAuth');
-    console.log(newAuth);
+    console.log(rawAuth);
     //console.log(grant);
     //var stringauth;
     var err;
@@ -253,8 +253,8 @@ var Server = {
       return state.Promise.reject(err);
     }
 
-    if ('string' !== typeof newAuth) {
-      newAuth = JSON.stringify(newAuth);
+    if ('string' !== typeof rawAuth) {
+      rawAuth = JSON.stringify(rawAuth);
     }
 
     // TODO don't fire the onAuth event on non-authz updates
@@ -266,7 +266,7 @@ var Server = {
     console.log('[onAuth] check for upgrade token');
     //console.log(grant);
     if (grant.jwt) {
-      if (newAuth !== grant.jwt) {
+      if (rawAuth !== grant.jwt) {
         console.log('[onAuth] new token to send back');
       }
       // TODO only send token when new
@@ -277,7 +277,7 @@ var Server = {
         , null
         , [ 3
           , 'access_token'
-          , { jwt: grant.jwt || grant.access_token }
+          , { jwt: grant.jwt }
           ]
         , 'control'
         );
@@ -356,7 +356,7 @@ var Server = {
     }
     grant.ports.forEach(openPort);
 
-    srv.grants[newAuth] = grant;
+    srv.grants[rawAuth] = grant;
     console.info("[ws] authorized", srv.socketId, "for", grant.currentDesc);
 
     console.log('notify of grants', grant.domains, grant.ports);
@@ -450,11 +450,13 @@ var Server = {
         state.srvs[validatedTokenData.id] = {};
       }
       if (!state.srvs[validatedTokenData.id].updateAuth) {
-        state.srvs[validatedTokenData.id].updateAuth = function (validatedTokenData) {
+        // be sure to always pass latest srv since the connection may change
+        // and reuse the same token
+        state.srvs[validatedTokenData.id].updateAuth = function (srv, validatedTokenData) {
           return Server.onAuth(state, srv, rawAuth, validatedTokenData);
         };
       }
-      state.srvs[validatedTokenData.id].updateAuth(validatedTokenData);
+      state.srvs[validatedTokenData.id].updateAuth(srv, validatedTokenData);
     });
   }
 , removeToken: function removeToken(state, srv, jwtoken) {