moved auth out to function