should we maybe move the auth backends somewhere else?