moved auth utils here