initial implementation of auth