auth, the right way
layout