still working on auth portion