clone from cc/express4auth