createauth is now authString()