kontrol: separate auth from constructor