fix auth & split auth/access to seperate functions