better to show auth on new rather than create