authorisation works -- strings in C are crapshit