use local app auth and not contrib.auth