moved auth to header