fleshing out auth