diff --git a/auth.lisp b/auth.lisp
index fdb3c73..15604be 100644
--- a/auth.lisp
+++ b/auth.lisp
@@ -12,7 +12,7 @@
               ;; authenticates the user via username and password
               (gethash "AccessToken"
                        (json-request (format-url domain "Users/AuthenticateByName")
-                                     (generate-authorization)
+                                     :auth (generate-authorization)
                                      :method :post
                                      :content `(("Username" . ,(getf options :username))
                                                 ("Pw" . ,(getf options :password))))))))
@@ -23,7 +23,7 @@
 (defun quick-connect-dance (domain)
   (let* ((auth (generate-authorization))
          (qc-session (handler-case
-                         (json-request (format-url domain "QuickConnect/Initiate") auth)
+                         (json-request (format-url domain "QuickConnect/Initiate") :auth auth)
                        (dex:http-request-unauthorized ()
                          (error "QuickConnect not enabled on this server.")))))
     ;; initiate quick connect session
@@ -44,7 +44,7 @@
              (sleep 5)
              (let ((state (json-request (format-url domain "QuickConnect/Connect?secret=~A"
                                                     (gethash "Secret" qc-session))
-                                        auth)))
+                                        :auth auth)))
                (setf authed (gethash "Authenticated" state)
                      counter (1+ counter)))
 
@@ -52,7 +52,8 @@
              (when (> counter 20)
                (error "QuickConnect session timed out.")))
     (gethash "AccessToken"
-             (json-request (format-url domain  "Users/AuthenticateWithQuickConnect") auth
+             (json-request (format-url domain  "Users/AuthenticateWithQuickConnect")
+                           :auth auth
                            :method :post
                            :content (jzon:stringify (alist-hash-table `(("Secret" . ,(gethash "Secret" qc-session)))))
                            :extra-headers '(("Content-Type" . "application/json"))))))
diff --git a/seanut.lisp b/seanut.lisp
index b1de2e2..ac18f02 100644
--- a/seanut.lisp
+++ b/seanut.lisp
@@ -29,10 +29,10 @@
                                  (json-request (format-url domain "Shows/~A/Episodes?fields=Path~@[&season=~A~]"
                                                            (gethash "Id" item)
                                                            (getf opts :season-number))
-                                               auth)
+                                               :auth auth)
                                  (json-request (format-url domain "Items?fields=Path&parentId=~A"
                                                            (gethash "Id" item))
-                                               auth))))
+                                               :auth auth))))
                (if (zerop (length children))
                    ;; download single file
                    ;; to get the extension type i think we may need to include
@@ -104,6 +104,8 @@
              ;;        certain info? when we run the parentID search it craps out on us?
              ;; maybe its not something wrong with the token, but the auth string as a
              ;; whole? look into this more tomorrow
+             ;;
+             ;; after reading more 
              (loop :for item :across results
                    :do (prompt-and-download domain authorization
                                             item (getf opts :assume-yes)))
diff --git a/web.lisp b/web.lisp
index 10c2b40..a6ca38f 100644
--- a/web.lisp
+++ b/web.lisp
@@ -20,21 +20,25 @@ ARGS are the arguments for the SLUG format string"
           (uiop:string-prefix-p "https://" domain)
           domain (apply #'format `(nil ,slug ,@args))))
 
-(defun json-request (url auth &key (method :get) extra-headers content)
+(defun json-request (url &key auth (method :get) extra-headers content)
   "makes a request to URL, using AUTH as the X-Emby-Authorization header and METHOD as the http method (defaults to get) and parses the returned value with jzon:parse
 
 if EXTRA-HEADERS is non-nil, includes them in the headers alongside the X-Emby-Authorization one
 if CONTENT is non-nil, passes that along to the request"
   (parse (dex:request url :method method
                           :content content
-                          :headers `(("Authorization" . ,auth)
+                          :headers `(,(when auth
+                                        `("Authorization" . ,auth))
                                      ,@extra-headers))))
 
 (defun run-search-query (domain auth type name)
+  "runs the search query to get the initial list of items
+
+can probably be removed and the request can be made in-line"
   (gethash "Items"
            (json-request (format-url domain "Items?fields=Path&includeItemTypes=~A&recursive=true&searchTerm=~A"
                                      type name)
-                         auth)))
+                         :auth auth)))
 
 (defun download-media (path url auth)
   "downloads the media at URL, using HEADER as the authorization header.