last of auth stuff