might be more elegant to just do `auth.shift()` and `auth.join(':')` there