more logic in auth system