Add out-of-band auth, + always call a callback

ah, you can switch to ```_successHandler(); return;```, that's probably more standard. I use a lot of callbacks in my day-to-day code (Node.js), and I've found that combining the ```return``` with the callback helps me avoid bugs where I forget the return statement... which can get really weird with multiple callbacks called, etc