more tweaks to auth