add SSL in production
finish auth