refactor auth code