auth process seems to fairy ok in theory on server side