refactor: move auth to _config