working on subresources and improved auth