auth.js - add cache-control, update some http codes