start fleshing out auth