auth design some more