refactoring auth code