add auth on site and app