add auth template and express get handler