stepping up with auth