Add tree attachments; externalize clj-auth and rework auth code