With the auth trampoline class gone, ivars can all be private