encapsulated auth logic in helper