api auth seems to be complete for now, will have to get to client auth before it all falls into place