moved auth into its own module