moved auth out of callback for stability reasons (hopefully works"!)