dropping in user auth is tricky. Might start fresh.