rough allowing of refresh with current auth