refactoring + handle authentication.
WIP: not tested as the API is not live yet