playing with auth redirect