auth.js - everything