Don't tie auth logic to specific domain
Don't use hardcoded domain for javascript urls
allow passing of port and services domain into commands