moved authentication stuff from app.js to authentication.js