starting the box/pastry approach (not tracking authentication yet)