clean up server, move some auth logic