decoupled authenticate and error handling

now authentication is done with core.authenticate decorator