Allow auth via querystring

Chew on this.