auth as a param instead of a header