auth before app load if prod