move authentication into separate plugin