refactor top level, auth to services