once before the auth and once after?