Add auth to window.user and fix buttons displaying when should be hidden