s/NEXT/next/; add dummy new() method
members folders support
allow broken hash strings → auth simply fails with them