more work on auth.php