WebAuth.start/finish: Return pairs instead of using wrapper objects.