move catch out to caller so they can deal as appropriate and get ready for multiple possible realms
change auth a little bit to actually consider usernames (admin or event) to determine how they are trying to login