fix specifying multiple auth servers; auth refactor