refactoring auth part 2