i was looking at the react-auth recipe for some clues, i knew that should be somewhere in the backend also