more auth stuff... getting there...