separate auth concerns out even more (incomplete)