finish rejig of the auth stuff