more working auth stuff