hmm good point, how do we do auth? that's probably a Story so we can think about the best way to do it