finish modular auth (closes #27)