moved auth details out of the server js