auth.js should not's know about app.js