move auth to seperate file