auth implemented, api separated cleanly from auth