auth only when no current user already set...