co-auth: compound auth