fell back a bit on custom auth, starting over