/auth returns authorization (needs to be tested)