auth simplification. allow for dupe device_ids