Break auth from app

Follow-on to #1345 further improving our forms.

This one breaks out the authentication into a separate module with tests.
These are two huge methods, and makes this hard to read, can we split them out into two or more functions