add auth to login, tidy ENV Key