add auth option to server.js