https and cleaned up auth.js a bit