Allow @auth_app to optionally include a user
Use NetID instead of eppn