custom authentication replaced with omniauth