move Authentication into separate package