factor out auth method