some more work on auth