auth&validation