behaviour good; require auth and js refactoring