working on rest api / auth