move getting current user to security service
extract authentication to dedicated service