adding authentication and locking it down