only auth if needed, report time left