more refactoring on authentication