moving auth into its own file