move api auth out of findOne and emit nodeStack event