refactor authentication & authorization