auth-manager: rework auth-manager's API