fix things which django seems to have broken
if client uses bad token, redo auth flow (instead of failing silently with no debug info)
use a variable for auth domain, so it can be varied per env