auth works for mirror api, moving around a few things