initial auth, app set up