more work on auth and data layers