pulled auth back out, we're vanilla now