more work on magic auth