Moving internal authentication methods to auth.py