auth now works - mostly