move checkauth() into sync.js