move the loading of features higher up

so that folks can add auth functions  in their configured features and have the auth check be able to use those functions.  This change doesn't seem to break anything else.