- correct auth check for real :)
- cosmetic on logging