found nasty bug with update and del in express router auth