Is there a reason we're not taking advantage of the automatic form auth checking here? ( `form_auth => 1` )?