Refactor api.auth to use db2

resolves #40