auth directive 'working'. not tested yet