moved auth to api