refactor auth logic into auth.py