almost working auth