auth working correctly