auth not working, should be changed to use owin