deleting auth.coffee, prefer to use roles.coffee