split files into multiple processing phases
added scoping to authn requests/responses