More authentication work. Moved code into auth