Make authentication more configurable and testable, and move to a sane namespace for web controllers.