refactor user login states
add auth documentation
limit app to user auth states
[cs] mark dev parts of app as deprecated