move authentication into a plugin