half finished auth