extracting auth into its own file