return json instead of list
redirect to auth page