refactor authentication