auth now returns both username and apikey