restructure app, auth in header