use check_auth instead of login for auto-re-auth