more authentication refactoring