use proper boolean function instead of session for auth
remove ability to pass current user into auth method (for now)