added auth, need to fix erb