tidy web.configs
work on authentication