improving the structure of the auth service; pulling core stuff into its own sub pkg