refactor - put auth code together