post as application/json
add registration and refactor authorization