it just doesn't work if it's not authenticated