changed to localstrategy for auth