Move password auth into its own module