screw having a separate auth resource anyway