moving auth to ng-click