DRY auth checks; rename stuff; don't leak errors