clean up auth app.js