auth now basically works