refactored pending updates once more; mntbyauth no more pending, but added a filtering mechanism to authenticator instead