changes to auth.js