more robust code for auth