cleaned up auth.js, added some documentation