flexable auth check