modified auth.js, may remove it later