device is now an obj

also fix auth