lots of auth stuff