refactoring auth code as part of #44