buffered auth biased for a single socket to keep post payload small.

Per #1, normal use-case involves a single socket_id, so batch by socket_id to keep POST payload trim.

Note: I guessed at the changes for auth.php.  Let me know if I missed something.