small fixes, still missing auth