should we alert if the auth length does not match>