auth nearly implemented