better outlining of auth behavior