actually implement auth
merge