ugly but it gets the auth right