more auth + clean up