removing user_database
adjusting super call and returning self.app only if authed