Custom Function authentication and POST method

The authentication function should be run as system thats correct.

It should not be run from anywhere but the authentication flow and should be marked as Private I believe…