changes in Auth, switch to JSON