modular auth, part 3: move core interfaces over to auth_ops.