finished most of auth