tweaked authorization/handshake @ app.js