auth working:
finish phase 2