diff --git a/servant-server/src/Servant/Server/Internal.hs b/servant-server/src/Servant/Server/Internal.hs
index 15bc3392..3761de29 100644
--- a/servant-server/src/Servant/Server/Internal.hs
+++ b/servant-server/src/Servant/Server/Internal.hs
@@ -15,6 +15,7 @@
 
 module Servant.Server.Internal
   ( module Servant.Server.Internal
+  , module Servant.Server.Internal.Authentication
   , module Servant.Server.Internal.PathInfo
   , module Servant.Server.Internal.Router
   , module Servant.Server.Internal.RoutingApplication
diff --git a/servant-server/src/Servant/Server/Internal/Authentication.hs b/servant-server/src/Servant/Server/Internal/Authentication.hs
index f594bc29..10f70d3c 100644
--- a/servant-server/src/Servant/Server/Internal/Authentication.hs
+++ b/servant-server/src/Servant/Server/Internal/Authentication.hs
@@ -45,8 +45,8 @@ data AuthHandlers authData = AuthHandlers
 -- | concrete type to provide when in 'Strict' mode.
 data instance AuthProtected authData usr subserver 'Strict =
     AuthProtectedStrict { checkAuthStrict :: authData -> IO (Maybe usr)
-                        , subServerStrict :: subserver
                         , authHandlers :: AuthHandlers authData
+                        , subServerStrict :: subserver
                         }
 
 -- | concrete type to provide when in 'Lax' mode.
@@ -63,8 +63,8 @@ laxProtect = AuthProtectedLax
 
 -- | handy function to build an auth-protected bit of API with a Strict policy
 strictProtect :: (authData -> IO (Maybe usr)) -- ^ check auth
-              -> subserver                    -- ^ handlers for the auth-protected bits of the API
               -> AuthHandlers authData        -- ^ functions to call on auth failure
+              -> subserver                    -- ^ handlers for the auth-protected bits of the API
               -> AuthProtected authData usr subserver 'Strict
 strictProtect = AuthProtectedStrict
 
@@ -92,7 +92,7 @@ basicAuthStrict :: KnownSymbol realm
                 => (BasicAuth realm -> IO (Maybe usr))
                 -> subserver
                 -> AuthProtected (BasicAuth realm) usr subserver 'Strict
-basicAuthStrict check subserver = strictProtect check subserver basicAuthHandlers
+basicAuthStrict check subserver = strictProtect check basicAuthHandlers subserver
 
 -- | Basic authentication combinator with lax failure.
 basicAuthLax :: KnownSymbol realm
diff --git a/servant-server/src/Servant/Server/Internal/Enter.hs b/servant-server/src/Servant/Server/Internal/Enter.hs
index 35e2991a..e7551032 100644
--- a/servant-server/src/Servant/Server/Internal/Enter.hs
+++ b/servant-server/src/Servant/Server/Internal/Enter.hs
@@ -106,7 +106,7 @@ generalizeNat = Nat (pure . runIdentity)
 
 -- | 'Enter' instance for AuthProtectedStrict
 instance Enter subserver arg ret => Enter (AuthProtected authData usr subserver 'Strict) arg (AuthProtected authData usr ret 'Strict) where
-    enter arg (AuthProtectedStrict check subserver handlers) = AuthProtectedStrict check (enter arg subserver) handlers
+    enter arg (AuthProtectedStrict check handlers subserver) = AuthProtectedStrict check handlers (enter arg subserver)
 
 
 -- | 'Enter' instance for AuthProtectedLax
diff --git a/servant-server/test/Servant/ServerSpec.hs b/servant-server/test/Servant/ServerSpec.hs
index 6ba833ce..ea437ca5 100644
--- a/servant-server/test/Servant/ServerSpec.hs
+++ b/servant-server/test/Servant/ServerSpec.hs
@@ -778,7 +778,6 @@ authRequiredApi = Proxy
 authRequiredServer :: Server AuthRequiredAPI
 authRequiredServer = basicAuthStrict basicAuthFooCheck (const . return $ alice)
                 :<|> basicAuthStrict basicAuthBarCheck (const . return $ jerry)
--- authRequiredServer =  const (return alice) :<|> const (return jerry)
 
 -- base64-encoded "servant:server"
 base64ServantColonServer :: ByteString