start to move auth functions into own package