building out auth