auth refactoring