wrapping everything in auth