some refactoring, missing auth and code cleanup