isolate the auth code to auth.py from base.py