move auth out to its own file