pulled out some of the auth stuff. lets see if we can get a request object going with the simpler cases, then generalize back to auth