refactor auth to service