auth works, no password yet