thinking about auth