no need for sandbox
move eval to its own module, feature to load & unload npm modules
return if user is already authed