login works, but what is the strategy for auth and auth and storing data.