poking around userAuth sources