clarifying thoughts on auth