address review in custom auth