first pass at fleshing out auth workflows