[server] better api.auth