rest auth typo fix
small koa fixes
code refactoring, security enhancements