some progress with auth