change auth to use findOrCreate