handled auth in a right way