tweak auth per shopify's batman example app. still not quite working.