set up auth callbacks

Self merge. #oops