more work on auth