Expose the AUTH_IN_PROGRESS string only to child (derived) classes

- Derived classes should let the parent class deal with processing, this
includes the authorisation process.

- Cleaned up a mess I made in the comments.