refactor auth