auth is mostly done