fleshed out api auth section