refactoring auth