refactoring auth system