refactored auth, fully tested