fixed auth, refactor