Expose the AUTH_IN_PROGRESS string only to child (derived) classes:
Derived classes should let the parent class deal with processing, this
includes the authorisation process.