migrate ResourceAuthenticator into here from separate package