moved auth logic