update
- fix authentication
- using hasmany instead of HABTM