usernames do auth as well