fixed auth to pull from a hidden file closes #22