WIP refactor auth and remove g.user to using current_user