has to be all capital, otherwhise there is no auth