feat: add auth.php and refactor all authentication handling