tidied up some auth helper code and started using the request-stashed user id value instead of always parsing the cookie (should be more performant)
made the auth helpers work better, for realzies