own minimal auth module, and comma-first