make module as simple as possible, move auth to the client API