move authentication to main.js