auth almost finished