auth refactored and almost working...