separate view, response, model
add auth