clean up auth check code and add allow in catalog