extract authentication into service
add credit
add security basics