move auth to secure