move is_authed to private _is_authed