move authentication code to separate, exported function