refactored auth code