flesh out auth