use auth utils instead of hardcoded sql