moved auth to its own action