bug in app.js still req auth