halfway done refactoring server-side auth code