moved check to doAuth.. method