move auth declarations from directory to location header