work on auth logic