support both req.apiPass & req.authPass
add files into package.json