Move all auth stuff into a role