* do auth and return json object