Auth: return a message, cleanup app.js