first pass at auth