moved auth to use env