require auth where I thought it was required. fix some minor bugs