[api] return the result instead of a bool on auth