seems like people may get confused between authId, authToken because of their position