move auth handler into auth package