only carry out stuff after auth