auth directive works