auth fixex & add auth.md