finish api auth system & remake of routes