add authentication service and test
remove auth-before