halfway through HS auth refactor