moving the auth stuff into separate module