slight client/auth callback redesign