trying a different approach to auth