switched auth mechanics to passport js