REF: move auth.js into a separate dir