basics of auth with local strategy, some refactoring and improvements