cleaned up auth code