working login auth checks