tentatively working bearer auth