ActionFinish in the API

Last mile of the ActionFinish function to the API
I'm not quite in love with this, because it comes *very* close to yuckily mixing auth and logic, but (1) it's arguably perfectly cohesive and (2) it makes its clients' code *so much nicer*, so I think it's good.