Lock down more URLs, and do the org-auth much earlier.