auth.js - return after res.end()