checkAuth in separate private method