move HACKING and add AUTH to a manual dir
add failure expectations because these high level auth tests are broken.