thinking through
working on auth