firmed up err handling and auth