more auth, more cleanup