More progress towards moving auth logic to new file