is the auth provided here production ready? what steps do we need to take to make sure it's got prod ready auth?