refactor authentication to separate identification (principal) from signature (credentials)