more work on auth.php and login page