Cleaning up the auth logic

did a bit of cleanup to the auth logic, as well as added the rest of the
support for multiple domains accessing the same appID buckets