final auth.py