begin to properly auth the code server too