switched Rollcall.Authenticator to use single-user picker