fixed auth creation

reverted line 88 and changed line 49 to auth.user !== 'object'