modular auth, part 5: break out certfp auth