make sure that keys are passed to auth before checking them