rev 1 to make auth server support 1+ auth schemes
minor refactor/perf-improvement/doc-improvement
moving hmac auth into its own module