move auth from create to new; old way caused lost submissions