auth&login: api change + clean + few fixes