added auth GET // eventual POST
fixed authentication