still buggering around with auth