auth work, incomplete