take auth-stuff as args, and do both kind of requests