add missing encoding comments at the top of files
Move auth-specific stuff into auth package