refactor authentication and initial work on authorisation