auth in separate file