fine-tuning login auth, persistence