refactor some authentication code