you should probably do this on login instead