moved uploaded files to storage and fixed auth