auth username should not be hard code