more complete models, auth middleware, starting into apps