authentication wrappers - really quite oxford  (well AD + nis) specific