refactoring Auth