isn't hardcoding AUTH_RETURN_CANCEL breaking the abstraction?