Move auth logic into authorization helper