move auth logic to /auth.php