refactor auth mechanism