didn't do nav or sessions. fixed JS auth