diff --git a/server/mergin/app.py b/server/mergin/app.py
index e1cc83d8..845bb89b 100644
--- a/server/mergin/app.py
+++ b/server/mergin/app.py
@@ -155,7 +155,7 @@ def create_app(public_keys: List[str] = None) -> Flask:
     from itsdangerous import BadTimeSignature, BadSignature
 
     from .audit import register as register_audit
-    from .auth import auth_required, decode_token, register as register_auth
+    from .auth import auth_required, decode_token, load_user, register as register_auth
     from .auth.models import User
     from .sync.app import register as register_sync
     from .sync.project_handler import ProjectHandler
@@ -190,14 +190,7 @@ def create_app(public_keys: List[str] = None) -> Flask:
     server_commands(app.app)
 
     # adjust login manager
-    @login_manager.user_loader
-    def load_user(session_id):  # pylint: disable=W0613,W0612
-        user_id, *rest = session_id.split(":")
-        # legacy session cookies carry only the user id
-        auth_version = int(rest[0]) if rest else 0
-        user = User.query.get(user_id)
-        if user and user.active and user.auth_version == auth_version:
-            return user
+    login_manager.user_loader(load_user)
 
     @login_manager.header_loader
     def load_user_from_header(header_val):  # pylint: disable=W0613,W0612
diff --git a/server/mergin/auth/__init__.py b/server/mergin/auth/__init__.py
index ef4bb687..59f80c09 100644
--- a/server/mergin/auth/__init__.py
+++ b/server/mergin/auth/__init__.py
@@ -3,4 +3,4 @@
 # SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-MerginMaps-Commercial
 
 from .bearer import decode_token
-from .app import auth_required, register
+from .app import auth_required, load_user, register
diff --git a/server/mergin/auth/app.py b/server/mergin/auth/app.py
index bb51c687..15685e4e 100644
--- a/server/mergin/auth/app.py
+++ b/server/mergin/auth/app.py
@@ -99,6 +99,16 @@ def wrapped_func(*args, **kwargs):
     return wrapped_func
 
 
+def load_user(session_id):
+    """Flask-Login user loader for session cookies"""
+    user_id, *rest = session_id.split(":")
+    # legacy session cookies carry only the user id
+    auth_version = int(rest[0]) if rest else 0
+    user = User.query.get(user_id)
+    if user and user.active and user.auth_version == auth_version:
+        return user
+
+
 def authenticate(login, password):
     from ..app import db