fix auth bug
serve a static site with express