I'm going to push back on refactoring existing code as part of the auth PRs, even when I agree with a suggested change in isolation. The auth feature is big and high risk, so I think there's a lot of value in scoping the PRs strictly to what's necessary for auth.