Garbage collect, move need_auth() calls around