almost done with auth