diff --git a/cookie_api/app.py b/cookie_api/app.py
index 86252e6..af9de99 100644
--- a/cookie_api/app.py
+++ b/cookie_api/app.py
@@ -17,6 +17,7 @@ cookie_schema = CookieSchema()
 
 logger = logbook.Logger('Cookies')
 
+
 @annotate(authentication=[JWTAuthentication()])
 def get_state(injector: Injector, auth: Auth):
     state = injector.state
@@ -43,12 +44,6 @@ def get_cookie(session: Session, id):
 
 def create_cookie(session: Session, json_data: http.RequestData, route: Router):
     cookie_data = cookie_schema.load(json_data)
-
-    #cookie = Cookie(name=json_data['name'],
-    #                recipe_url=json_data['recipe_url'],
-    #                sku=json_data['sku'],
-    #                qoh=json_data['qoh'],
-    #                unit_cost=json_data['unit_cost'])
     cookie = Cookie(**cookie_data)
     session.add(cookie)
     session.commit()
@@ -64,7 +59,8 @@ def delete_cookie(session: Session, id: int):
     session.delete(cookie)
     return {"message": "200 OK"}
 
-routes = [
+
+_routes = [
     Route('/state', 'GET', get_state),
     Route('/cookies', 'GET', get_cookies),
     Route('/cookies', 'POST', create_cookie),
@@ -79,14 +75,14 @@ app_settings = {
     }
 }
 
-routes = routes + auth_routes
+_routes = _routes + auth_routes
 
-commands = sqlalchemy_backend.commands + commands
+_commands = sqlalchemy_backend.commands + commands
 
-components = sqlalchemy_backend.components + auth_components
+_components = sqlalchemy_backend.components + auth_components
 
 
-def application_factory(settings={}):
+def application_factory(settings={}, routes=_routes, commands=_commands, components=_components):
     """Returns an instance of Cookie API"""
     _settings = {**app_settings, **settings}
 
diff --git a/cookie_api/auth.py b/cookie_api/auth.py
index 8c21a9c..7b900f3 100644
--- a/cookie_api/auth.py
+++ b/cookie_api/auth.py
@@ -7,17 +7,11 @@ from apistar_jwt.token import JWT
 
 from cookie_api.models import User
 
-# /auth/register
-# /auth/user
-# /auth/logout
-
-
 auth_components = [
     Component(JWT, init=get_jwt)
 ]
-[]
 
-# /auth/login
+
 def login(settings: Settings, json_data: http.RequestData, session: Session):
     user_id = json_data.get('email')
     password = json_data.get('password')
@@ -27,7 +21,7 @@ def login(settings: Settings, json_data: http.RequestData, session: Session):
         error = {'error': 'Password auth failed'},
         return http.Response(error, status=401, headers={'WWW-Authenticate': 'Bearer'})
 
-    SECRET = settings['JWT'].get('SECRET')
+    secret = settings['JWT'].get('SECRET')
 
     payload = {
         'exp': dt.datetime.utcnow() + dt.timedelta(days=0, minutes=60),
@@ -35,7 +29,7 @@ def login(settings: Settings, json_data: http.RequestData, session: Session):
         'sub': user.id
     }
 
-    token = JWT.encode(payload, secret=SECRET)
+    token = JWT.encode(payload, secret=secret)
 
     data = {
         'status': 'success',
@@ -46,6 +40,31 @@ def login(settings: Settings, json_data: http.RequestData, session: Session):
     return data
 
 
+# TODO Add user logout
+def logout():
+    pass
+
+
+# TODO Add user registration
+def register():
+    pass
+
+
+# TODO Add user profile endpoint
+def user_profile():
+    pass
+
+
+# TODO Add email confirmation
+def confirm():
+    pass
+
+
+# TODO Add email password reset
+def reset():
+    pass
+
+
 routes = [
     Route('/login', 'POST', login)
 ]
diff --git a/cookie_api/models.py b/cookie_api/models.py
index 4a2df8c..caa2ebe 100644
--- a/cookie_api/models.py
+++ b/cookie_api/models.py
@@ -6,7 +6,8 @@ from sqlalchemy.sql import expression
 from sqlalchemy.ext.compiler import compiles
 from sqlalchemy.types import DateTime as DateTimeType
 
-BCRYPT_LOG_ROUNDS = 13
+BCRYPT_LOG_ROUNDS = 11
+
 
 # can be moved to models util?
 class utcnow(expression.FunctionElement):