moved auth into base