remove Google API Key from auth.js; ask Duc for the key; don't commit this key