auth at the backbone level